On October 31, 2026, Bitcoin staking protocol b14g suffered a $1.47 million exploit that drained approximately 97 million CORE tokens. The attacker exploited a vulnerability where submitting zero-value withdrawal requests against unfunded positions triggered Core's contract to release entire balances. While exchange partners froze roughly 9 million stolen CORE, b14g confirmed that staked Bitcoin on the BTC blockchain remained secure and unaffected.
Details of the b14g exploit
- ▪Bitquery reported that the contract logic exploited in the October 31, 2026 b14g breach had been in place for approximately 17 months and required no compromised administrator key
- ▪The attacker behind the October 31, 2026 b14g exploit exploited b14g by submitting 99 zero-value withdrawal requests against unfunded staking positions, which Core's staking contract interpreted as instructions to withdraw entire balances
- ▪Bitcoin staking platform b14g lost approximately 97 million CORE tokens, valued at $1.47 million, during an exploit
- ▪b14g paused its affected smart contracts at 10:35 UTC on October 31, 2026, approximately 66 minutes after the initial unauthorized withdrawals in the b14g exploit occurred
- ▪Blockchain analytics firm Bitquery reported that the $1.47 million b14g exploit occurred at 09:29 UTC on October 31, 2026, draining 91 staking positions in a single transaction
Movement and freezing of stolen tokens
- ▪Following the October 31, 2026 b14g exploit, the b14g exploit attacker transferred 23 million stolen CORE tokens across newly created wallet addresses before b14g paused affected contracts
- ▪Bitquery reported that CORE tokens stolen in the b14g exploit moved through intermediary addresses linked to exchanges Bybit, Gate.io, and MEXC, leaving 68 million CORE unmoved across three wallets
- ▪Exchange partners froze approximately 9 million stolen CORE tokens linked to the b14g exploit attacker following the October 31, 2026 exploit of b14g
- ▪Bitquery identified a transaction fee provider that received 11 million stolen CORE tokens from the b14g exploit attacker and forwarded them to an MEXC deposit address
Assurances on unaffected assets
- ▪b14g confirmed that CORE tokens staked directly with validators or through non-b14g protocols were not affected by the October 31, 2026 b14g exploit
- ▪b14g confirmed that the October 31, 2026 b14g exploit was limited to CORE deposits and that Bitcoin staked through the protocol remained secure on the Bitcoin blockchain
- ▪Core DAO stated that its underlying blockchain, consensus mechanism, validators, and staking contracts remained uncompromised and fully operational during the October 31, 2026 $1.47 million b14g exploit
Story comments
Loading comments…